<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
  
<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/MFT.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:23:58 GMT -->
<head>
    <title>NTFS Documentation: $MFT</title>
  </head>

  <body>
      <h1><a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a> Documentation: $MFT</h1>

      <h2>Definition</h2>

      In <a href="index-2.html#NTFS" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/index.html#NTFS">NTFS</a>, everything is a <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>. Even all <a href="glossary.html#Metadata" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Metadata">metadata</a> are stored in <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>s called <a name="system_file">system <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>s</a>. It is quite unusual for a <a href="glossary.html#Filesystem" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Filesystem">filesystem</a>, but it allows the <a href="glossary.html#Filesystem" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Filesystem">filesystem</a> driver to manipulate these data in a generic way (for example, to perform access control on them), and since these data can be moved and located anywhere on the storage unit, it reduces the risk of damage. The Master File Table (MFT) is the most important <a href="#system_file">system file</a>. It contains information about all the <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a>s of the <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a>. There is exactly one MFT per <a href="glossary.html#Volume" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#Volume">volume</a>.
      <p>

      <h2>Layout</h2>

      The MFT is a sequence of <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>s. The first 16 <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>s describe <a href="#system_file">system file</a>s, as follows:
      <p>

      <table border=2 cellspacing=2 cellpadding=2>
	<tr bgcolor="#E0E0E0">
	  <th><a name="file_record_number"><a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a> number</a></th>
          <th><a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">File</a> name</th>
        </tr>
	<tr>
	  <th>0</th>
	  <th><a name="MFT"><a href="MFT.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFT.html">$MFT</a></a></th>
	</tr>
	<tr>
	  <th>1</th>
	  <th><a href="MFTMirr.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/MFTMirr.html">$MFTMirr</a></th>
	</tr>
	<tr>
	  <th>2</th>
	  <th>$LogFile</th>
	</tr>
	<tr>
	  <th>3</th>
	  <th><a href="Volume.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/Volume.html">$Volume</a></th>
	</tr>
	<tr>
	  <th>4</th>
	  <th><a href="AttrDef.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/AttrDef.html">$AttrDef</a></th>
	</tr>
	<tr>
	  <th>5</th>
	  <th><a name="rootdir">. (root <a href="dir.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/dir.html">directory</a>)</a></th>
	</tr>
	<tr>
	  <th>6</th>
	  <th><a href="Bitmap.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/Bitmap.html">$Bitmap</a></th>
	</tr>
	<tr>
	  <th>7</th>
	  <th><a name="Boot"><a href="Boot.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/Boot.html">$Boot</a></a></th>
	</tr>
	<tr>
	  <th>8</th>
	  <th><a href="BadClus.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/BadClus.html">$BadClus</a></th>
	</tr>
	<tr>
	  <th>9</th>
	  <th>$Quota</th>
	</tr>
	<tr>
	  <th>A</th>
	  <th><a href="upcase.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/upcase.html">$UpCase</a></th>
	</tr>
	<tr>
	  <th>B</th>
	  <th></th>
	</tr>
	<tr>
	  <th>C</th>
	  <th></th>
	</tr>
	<tr>
	  <th>D</th>
	  <th></th>
	</tr>
	<tr>
	  <th>E</th>
	  <th></th>
	</tr>
	<tr>
	  <th>F</th>
	  <th></th>
	</tr>
	<tr>
	  <th>10 and higer</th>
	  <th>Any <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a></th>
	</tr>
      </table>
      <p>

      <em>Note</em>: You probably noticed that the MFT is self-referencing. This situation could lead to an infinite loop during <a href="glossary.html#File" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/glossary.html#File">file</a> creation:
      <ol>
        <li>A new <a href="FILE.html#base" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#base">(base) FILE record</a> must be added to the <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> of the MFT, which is necessarily <a href="attribute.html#non_resident" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#non_resident">non-resident</a> (because its <a href="attribute.html#stream" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/attribute.html#stream">stream</a>, which at least contains the <a href="FILE.html#base" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#base">base FILE record</a> of the MFT, is necessarily larger than one <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>).
        <p>
        <li>The <a href="runlist.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/runlist.html">runlist</a> of the <a href="data.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/data.html">data attribute</a> of the MFT will grow.
        <p>
        <li>To store that, the MFT may require a new <a href="FILE.html#extension_record" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#extension_record">(extension) FILE record</a>...
        <p>

      </ol>
      To avoid this, <a href="FILE.html" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html">FILE record</a>s B to F are reserved for <a href="FILE.html#extension_record" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#extension_record">extension FILE record</a>s of the MFT itself (they are not for future use).  
      <p>

      <h2>Properties</h2>
      The MFT <a href="FILE.html#no_shrink" tppabs="http://www.via.ecp.fr/~regis/ntfs/new/FILE.html#no_shrink">can't shrink</a> when the system is running.
      <p>

      <hr>
      <address><a href="mailto:regis@via.ecp.fr">Regis Duchesne</a> at <a href="javascript:if(confirm('http://www.via.ecp.fr/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.via.ecp.fr/'" tppabs="http://www.via.ecp.fr/">VIA</a>, <a href="javascript:if(confirm('http://www.ecp.fr/  \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?'))window.location='http://www.ecp.fr/'" tppabs="http://www.ecp.fr/">ECP</a>, France</address>
<!-- Created: Mon Dec  9 09:25:52 MET 1996 -->
<!-- hhmts start -->
Last modified: Sun Feb 14 16:29:44 PST 1999
<!-- hhmts end -->
  </body>

<!-- Mirrored from bos.asmhackers.net/docs/filesystems/ntfs/MFT.html by HTTrack Website Copier/3.x [XR&CO'2013], Tue, 07 Oct 2014 11:24:00 GMT -->
</html>
